The APT15 hacking group has always been associated with Chinese intelligence and it has been part of quite a few, infamous hacking sprees. Now this group has allegedly stolen information about UK’s military technology by compromising computer of a UK government contractor and launching a malware-based attack.
As per the findings of information security training researchers of NCC Group, the Chinese linked APT15 (also known as Ke3chang, Vixen Pands, Mirage, Playful Dragon and GREF) hacker group has been eyeing data related to military technology and governmental departments of the UK. In this particular attack, APT15 used new backdoors while the targets were contractors working with different military units and government departments in the UK.
The findings were presented by NCC Group’s senior malware researcher Ahmed Zaki at Kaspersky’s Security Analyst Summit (SAS). In an official blog post, NCC Group explained that the Incident Response Team at NCC Group were called-in by a contractor who provided a wide range of services to the UK government and the team was requested to respond to a then on-going incident.
The blog stated that the client informed about becoming a victim of a network compromise that involved “advanced persistent threat group APT15.” The investigation was stopped in June 2017 on the request of the same client and then it was resumed in August once again when APT15 hackers again accessed victim’s network.
“APT15 managed to regain access a couple of weeks later via the corporate VPN solution with a stolen VPN certificate, which they had extracted from a compromised host,” the blog post read.
It seems like this attack is not an individual attempt but actually part of a bigger, wider operation that is aimed at UK government and military contractors. The hacker group is believed to be using two new backdoors along with malware that already has imprints of APT15. Information security training researchers wrote in their blog post:
“During our analysis of the compromise, we identified new backdoors that now appear to be part of APT15’s toolset. The backdoor BS2005, which has traditionally been used by the group, now appears alongside the additional backdoors RoyalCli and RoyalDNS. The RoyalCli backdoor appears to be an evolution of BS2005 and uses familiar encryption and encoding routines.”
RoyalCLI was tracked through a debugging path that was left in the binary and happens to be a successor of BS2005 backdoor that was also used by APT15 in one of its previous malicious campaigns. RoyalCLI and BS2005 use Internet Explorer via the COM interface IWebBrowser2 to communicate with their C&C server.
The second backdoor RoyalDNS utilizes DNS to create a link with its C&C server. When the command is executed, the backdoor returned output via the same DNS. The domain and IP address infrastructure analysis showed various domains that quite possibly were used by APT15 and hosted on Google Cloud and/or Linode.
“All of the backdoors identified, excluding RoyalDNS, required APT15 to create batch scripts in order to install its persistence mechanism. This was achieved through the use of a simple Windows run key.
Additional tools were recovered during the incident, including a network scanning tool, the archiving tool WinRAR and a bespoke Microsoft SharePoint enumeration and data dumping tool, known as ‘spwebmember’.” information security researchers explained.
APT15 did not give up and again accessed the system via the corporate virtual private network by using a stolen certificate.
“APT15 opted for a DNS based backdoor: RoyalDNS. The persistence mechanism used by RoyalDNS was achieved through a service called ‘Nwsapagent’,” while the C&C server of this backdoor used the TXT record of the DNS protocol and the server contacted with ‘andspurs[.]com’ domain, information security training analysts revealed.
Researchers were able to cache a number of C2 commands to the disk due to the IE injection technique that HTTP-based backdoors use. The files were recovered and reverse engineered by the researchers using the encoding routine that backdoors use to accurately uncover the commands executed by the attacker.
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
